<div class="content" name="ElfrReportEventA" uuid="38218308-ead6-4df0-a12b-cbece4f2e7d1"><p>The ElfrReportEventA (Opnum 18) method writes events to the <a href="e74c8719-c30e-4f7a-bef7-82753cc0e159#gt_bb3fad7e-60bf-46d4-9c3f-7caea47a743e" data-linktype="relative-path">event log</a>; the server
receives these events from the client.</p><dl>
<dd>
<div><pre> NTSTATUS ElfrReportEventA(
   [in] IELF_HANDLE LogHandle,
   [in] unsigned long Time,
   [in] unsigned short EventType,
   [in] unsigned short EventCategory,
   [in] unsigned long EventID,
   [in, range(0, 256)] unsigned short NumStrings,
   [in, range(0, 61440)] unsigned long DataSize,
   [in] PRPC_STRING ComputerName,
   [in, unique] PRPC_SID UserSID,
   [in, size_is(NumStrings), unique] 
     PRPC_STRING Strings[*],
   [in, size_is(DataSize), unique] 
     unsigned char* Data,
   [in] unsigned short Flags,
   [in, out, unique] unsigned long* RecordNumber,
   [in, out, unique] unsigned long* TimeWritten
 );
</pre></div>
</dd></dl><p><b>LogHandle: </b>Handle to an event log. This parameter is
a server context handle, as specified in section <a href="de54bfbc-fbe4-43b8-b8e1-b8a6b2189604" data-linktype="relative-path">2.2.6</a>. This handle MUST
NOT be obtained via the <a href="6dcf59eb-11ca-416f-9cc4-8f6c2979baad" data-linktype="relative-path">ElfrOpenBELA (section 3.1.4.2)</a>
method or the <a href="4db1601c-7bc2-4d5c-8375-c58a6f8fc7e1" data-linktype="relative-path">ElfrOpenBELW (section 3.1.4.1)</a>
method.</p><p><b>Time: </b>Time at which the event was generated by the <a href="e74c8719-c30e-4f7a-bef7-82753cc0e159#gt_efdc035d-100a-4568-a67f-69fb726fadcb" data-linktype="relative-path">event source</a> (not the time
at which the event was). The time MUST be expressed as the number of seconds
since 00:00:00 on January 1, 1970 (UTC).</p><p><b>EventType: </b>Type of the event, as specified in section
<a href="1ed850f9-a1fe-4567-a371-02683c6ed3cb" data-linktype="relative-path">2.2.2</a>. </p><p><b>EventCategory: </b><a href="e74c8719-c30e-4f7a-bef7-82753cc0e159#gt_218d3b23-9c27-45d5-a861-7b832d392fc6" data-linktype="relative-path">Event category</a>, as
specified in section <a href="c1f99c2e-b118-45e1-a414-007272fb9d43" data-linktype="relative-path">1.8.5</a>.
</p><p><b>EventID: </b><a href="e74c8719-c30e-4f7a-bef7-82753cc0e159#gt_edce565a-e2b7-40df-ab78-cbb3a49ff3bd" data-linktype="relative-path">EventID</a>, as specified in
section <a href="123d104a-39fd-4f60-8f7b-fbd9a43f88c1" data-linktype="relative-path">3.1.1.4</a>. </p><p><b>NumStrings: </b>Number of strings in the array pointed to
by the <i>Strings</i> parameter. A value of zero indicates that no strings are
present.</p><p><b>DataSize: </b>Number of bytes of event-specific raw
binary data to write to the log. This binary data is passed in the <i>Data</i>
parameter. If no event-specific data is present, this parameter MUST be set to
zero.</p><p><b>ComputerName: </b>A string to assist in identifying the
machine that generated the event. In practice, the name of the computer. There
are no character restrictions on this field&#39;s content (for example, a <a href="e74c8719-c30e-4f7a-bef7-82753cc0e159#gt_1769aec9-237e-44ed-9014-1abb3ec6de6e" data-linktype="relative-path">FQDN</a> can be used).<a id="Appendix_A_Target_31"></a><a aria-label="Product behavior note 31" href="4acc4fbc-1378-4120-83d1-cfb4ae0240e0#Appendix_A_31" data-linktype="relative-path">&lt;31&gt;</a></p><p><b>UserSID: </b>Either NULL or a user SID. If this is NULL,
the event is to have a zero length <b>UserSid</b> field.</p><p><b>Strings: </b>Specifies strings containing information
specific to the event. This parameter MUST be a valid pointer. If the <i>NumStrings</i>
parameter is zero, this parameter MUST be NULL. For example, an event relating
to file deletion could use a string to specify the path of the file being
deleted.</p><p><b>Data: </b>Pointer to the buffer that contains the
event-specific binary data. This parameter MUST be a valid pointer (or NULL),
even if the <i>DataSize</i> parameter is 0.</p><p><b>Flags: </b>Unused. MUST be set to zero when sent and MUST
be ignored on receipt.</p><p><b>RecordNumber: </b>Unused. Can be set to any arbitrary value
when sent, and any value sent by the client MUST be ignored on receipt by the
server.</p><p><b>TimeWritten: </b>Unused. Can be set to any arbitrary
value when sent, and any value sent by the client MUST be ignored on receipt by
the server.</p><p><b>Return Values: </b>The method MUST return STATUS_SUCCESS
(0x00000000) on success; otherwise, it MUST return an implementation-based,
nonzero NTSTATUS value specified in <a href="../ms-erref/1bc92ddf-b79e-413c-bbaa-99a5281a6c90" data-linktype="relative-path">[MS-ERREF]</a>.</p><p>This method is identical to the <a href="1e8cc02c-e5a5-4924-90b5-0aaa69da3571" data-linktype="relative-path">ElfrReportEventW (section 3.1.4.13)</a>
method except that the string arguments are ANSI strings in this case. Thus,
the remarks in ElfrReportEventW (section 3.1.4.13) apply to this
method as well.</p></div>